rbrooks/Circa

Watch

Fork 0

Configure Renovate #1

Closed

renovate-bot wants to merge 1 commit from renovate/configure into main

renovate-bot commented

2026-06-23 03:00:45 +00:00

Contributor

Welcome to Renovate! This is an onboarding PR to help you understand and configure settings before regular Pull Requests begin.

🚦 To activate Renovate, merge this Pull Request. To disable Renovate, simply close this Pull Request unmerged.

📚 See our Reading List for relevant documentation you may be interested in reading.

🔡 Do you want to change how Renovate upgrades your dependencies? Add your custom config to renovate.json in this branch. Renovate will update the Pull Request description the next time it runs.

Detected Package Files

frontend/package.json (npm)
backend/pyproject.toml (poetry)

What to Expect

With your current configuration, Renovate will create 3 Pull Requests:

Update dependency @vitejs/plugin-react to v6

Schedule: ["at any time"]
Branch name: renovate/vitejs-plugin-react-6.x
Merge into: main
Upgrade @vitejs/plugin-react to ^6.0.0

Update dependency typescript to v7

Schedule: ["at any time"]
Branch name: renovate/typescript-7.x
Merge into: main
Upgrade typescript to ^7.0.0

Update dependency vite to v8

Schedule: ["at any time"]
Branch name: renovate/vite-8.x
Merge into: main
Upgrade vite to ^8.0.0

🚸 PR creation will be limited to maximum 2 per hour, so it doesn't swamp any CI resources or overwhelm the project. See docs for prHourlyLimit for details.

❓ Got questions? Check out Renovate's Docs, particularly the Getting Started section.
If you need any further assistance then you can also request help here.

This PR has been generated by Mend Renovate.

Welcome to [Renovate](https://github.com/renovatebot/renovate)! This is an onboarding PR to help you understand and configure settings before regular Pull Requests begin. 🚦 To activate Renovate, merge this Pull Request. To disable Renovate, simply close this Pull Request unmerged. 📚 See our [Reading List](https://docs.renovatebot.com/reading-list/) for relevant documentation you may be interested in reading. 🔡 Do you want to change how Renovate upgrades your dependencies? Add your custom config to `renovate.json` in this branch. Renovate will update the Pull Request description the next time it runs. --- ### Detected Package Files * `frontend/package.json` (npm) * `backend/pyproject.toml` (poetry) ### What to Expect With your current configuration, Renovate will create 3 Pull Requests: <details> <summary>Update dependency @vitejs/plugin-react to v6</summary> - Schedule: ["at any time"] - Branch name: `renovate/vitejs-plugin-react-6.x` - Merge into: `main` - Upgrade [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react) to `^6.0.0` </details> <details> <summary>Update dependency typescript to v7</summary> - Schedule: ["at any time"] - Branch name: `renovate/typescript-7.x` - Merge into: `main` - Upgrade [typescript](https://github.com/microsoft/TypeScript) to `^7.0.0` </details> <details> <summary>Update dependency vite to v8</summary> - Schedule: ["at any time"] - Branch name: `renovate/vite-8.x` - Merge into: `main` - Upgrade [vite](https://github.com/vitejs/vite) to `^8.0.0` </details> 🚸 PR creation will be limited to maximum 2 per hour, so it doesn't swamp any CI resources or overwhelm the project. See [docs for `prHourlyLimit`](https://docs.renovatebot.com/configuration-options/#prhourlylimit) for details. --- ❓ Got questions? Check out Renovate's [Docs](https://docs.renovatebot.com/), particularly the Getting Started section. If you need any further assistance then you can also [request help here](https://github.com/renovatebot/renovate/discussions). --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-06-23 03:00:45 +00:00

Add renovate.json 7bdddd7138

claude-bot referenced this pull request

2026-07-28 04:52:52 +00:00

Add a Forgejo Actions CI pipeline #13

claude-bot referenced this pull request

2026-07-28 05:57:15 +00:00

Commit lockfiles and wire pip-audit / npm audit into CI #72

claude-bot referenced this pull request

2026-07-28 17:34:49 +00:00

Add a Forgejo Actions CI pipeline #13

claude-bot referenced this pull request

2026-07-28 17:34:49 +00:00

Commit lockfiles and wire pip-audit / npm audit into CI #72

claude-bot referenced this pull request

2026-07-28 17:34:49 +00:00

Branch protection and Renovate dependency automation #130

claude-bot commented

2026-07-28 17:48:20 +00:00

First-time contributor

Closing unmerged — onboarding is already complete, via a fuller config than this PR proposes.

This PR adds a renovate.json containing only the $schema line. A complete configuration was committed directly to main in 8a28bbb, so the two conflict (mergeable: false) and merging this would at best be a no-op and at worst replace the real config with a stub — discarding the automerge rules, the schedule, the grouping, and the never-automerge list for authlib, pillow, itsdangerous, and python-multipart.

What's on main now:

patch and minor automerge once CI is green; majors always held for review
weekly schedule, 5 concurrent PRs, 2/hour
monthly lock file maintenance
Python dependencies grouped; @types/* grouped
security-relevant packages never automerged, even on a patch
vulnerabilityAlerts enabled and labelled

Also relevant: this PR was raised before lockfiles existed, and detected backend/pyproject.toml as poetry. The project uses PEP 621 with pip-compile, and backend/requirements.txt / requirements-dev.txt are now committed, so Renovate will pick up the pip-compile and pip_requirements managers and update pinned versions rather than manifest ranges.

Renovate treats a closed onboarding PR as opt-out only when no config file is present. renovate.json exists on the default branch, so the config-file check short-circuits onboarding and this closure is inert.

Liveness check: the config sets :dependencyDashboard, so Renovate should open a "Dependency Dashboard" issue on its next run. If that issue appears, it is working. If nothing appears after the next scheduled run, re-check — the three queued majors (@vitejs/plugin-react v6, typescript v7, vite v8) should show up there awaiting review.

Closing unmerged — onboarding is already complete, via a fuller config than this PR proposes. This PR adds a `renovate.json` containing only the `$schema` line. A complete configuration was committed directly to `main` in 8a28bbb, so the two conflict (`mergeable: false`) and merging this would at best be a no-op and at worst replace the real config with a stub — discarding the automerge rules, the schedule, the grouping, and the never-automerge list for `authlib`, `pillow`, `itsdangerous`, and `python-multipart`. What's on `main` now: - patch and minor automerge once CI is green; majors always held for review - weekly schedule, 5 concurrent PRs, 2/hour - monthly lock file maintenance - Python dependencies grouped; `@types/*` grouped - security-relevant packages never automerged, even on a patch - `vulnerabilityAlerts` enabled and labelled Also relevant: this PR was raised before lockfiles existed, and detected `backend/pyproject.toml` as **poetry**. The project uses PEP 621 with pip-compile, and `backend/requirements.txt` / `requirements-dev.txt` are now committed, so Renovate will pick up the `pip-compile` and `pip_requirements` managers and update pinned versions rather than manifest ranges. Renovate treats a closed onboarding PR as opt-out **only when no config file is present**. `renovate.json` exists on the default branch, so the config-file check short-circuits onboarding and this closure is inert. Liveness check: the config sets `:dependencyDashboard`, so Renovate should open a "Dependency Dashboard" issue on its next run. If that issue appears, it is working. If nothing appears after the next scheduled run, re-check — the three queued majors (`@vitejs/plugin-react` v6, `typescript` v7, `vite` v8) should show up there awaiting review.

claude-bot closed this pull request

2026-07-28 17:48:31 +00:00

claude-bot referenced this pull request

2026-07-30 21:18:35 +00:00

Commit lockfiles and wire pip-audit / npm audit into CI #72

claude-bot referenced this pull request

2026-07-30 23:09:01 +00:00

Branch protection and Renovate dependency automation #130